PDF malware analysis — malicious · 4772c4416f01334e

MALICIOUS

PDF

359.8 KB Created: 2021-07-31 15:23:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: ef7760763f7858621a87eaadb992e42a SHA-1: dce9ef31d90c514ff3f3f0a0a38756386a8d99e0 SHA-256: 4772c4416f01334efdf065616507eae26012d13ba86b3decc122053d65467b05

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF file identified as malicious by ML classifiers and ClamAV. It contains embedded JavaScript, which is likely used to execute malicious actions, such as downloading a second-stage payload or redirecting the user to a phishing site. The presence of multiple external URIs, some pointing to compromised CMS upload directories, further supports a phishing or malware delivery intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9816

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.masismarketing.com/wp-content/plugins/super-forms/uploads/php/files/d07689a43760cc5d8b86c221e1295434/fofamajifoguvosazesigul.pdf In PDF document text
- http://townsendrogersfamilyreunion.com/clients/9/91/912616e09393d205379ff76530a10a1f/File/xopaxafu.pdfIn PDF document text
- http://aweibel.com/Photo/file/dadutodikukawuv.pdfIn PDF document text
- https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b54f8b0aef3---30205513609.pdfIn PDF document text
- http://mabo-meccanica.eu/userfiles/files/6764882397.pdfIn PDF document text
- https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072c71545b00---27871303749.pdfIn PDF document text
- https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/0fcf5ba8014725dc34b251a03e6c2c84/50880951722.pdfIn PDF document text
- https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/klgevioaa244uev9i3s7h3qo90/95462904903.pdfIn PDF document text
- https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/cm52tdt9bm1p01nm9llgghfu05/bebemanasobasutumunemif.pdfIn PDF document text
- https://memorybg.net/app/templates/js/ckfinder/userfiles/files/perolixiteje.pdfIn PDF document text
- http://gemwishrs.com/ckfinder/stones/files/lifapudedodovewuzane.pdfIn PDF document text
- http://stopasbestos.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb96ab8ac9---bujerotemajitono.pdfIn PDF document text
- https://www.swx.global/wp-content/plugins/super-forms/uploads/php/files/e0e37887b6686348f8c994417fc6c5a7/nakefiz.pdfIn PDF document text
- http://phanphoiongnhuahoasen.vn/upload/files/fivasogotaxamitewame.pdfIn PDF document text
- http://yournamebadges.com/withyourdog/cms_uploads/file/powetokugojuputebugew.pdfIn PDF document text
- http://altaprecision.com/userfiles/file/xapavofev.pdfIn PDF document text
- https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/58fbbf75ef683d06a5aaa594c8b6da71/fagidinevetokitijub.pdfIn PDF document text
- http://lushexperiences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160797cf257407---guxakarelilupazifaresopeb.pdfIn PDF document text
- https://eatorhours.org/e-bussiness/fckimages/file/gumip.pdfIn PDF document text
- https://advantagelic.com/singhania/downloads/file/18293857558.pdfIn PDF document text
- http://otvorene-srdce.sk/userfiles/file/repoxedopomogufuworixaleb.pdfIn PDF document text
- http://laser-piskovani.cz/democms/userfiles/file/bagifokukitotavuzajim.pdfIn PDF document text
- http://ordineveterinarivenezia.eu/userfiles/files/27318522322.pdfIn PDF document text
- http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/fjt89aae2ph1q7d6h2lgrc2l1t/wemibijaluw.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=kathryn+kuhlman+books+pdf+drivePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00052d5b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x52D5B	18360 bytes
SHA-256: `0f02f01aadab3cdaa3767d0760ef69adb7dbc0efc2f66a7477b0bbf4c5aaa874`
`font_01_sfnt_off00055e0c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x55E0C	11268 bytes
SHA-256: `2f2c5ee91a02a346b9785fdd54396905ceafd1ed50509fcf62b2dacc20125554`
`font_02_sfnt_off0005781e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5781E	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.